Subject: Important Security Notice Regarding Your Personal Information

At Pepkor Lifestyle, protecting our customers' information is a top priority. In the interest of transparency, we are issuing this notice to inform our customers about a data security incident that occurred at a third-party service provider we use for marketing and statement communications. On October 13, 2025, Mobiz discovered that an unauthorised party had gained access to one of its storage systems and viewed and deleted data related to marketing and statement campaigns.

What Information was Involved?

The investigation has confirmed that the information involved includes your cellphone number and the content of campaign messages we have sent to you through their service. Based on the information provided by our vendor, this incident was limited to this specific campaign data. It did not involve any broader customer databases, financial information, or other sensitive personal details.

What Does This Mean for You?

With this information, there is an increased risk that you may be targeted by scams, such as 'phishing' or 'smishing' text messages. These messages might appear to come from us or another trusted company and could ask you to click on a link or provide personal information.

What We Are Doing

We take the security of your information very seriously. We are in direct contact with Mobiz to oversee their forensic investigation and the implementation of their enhanced security measures. We have also notified the Information Regulator of this incident as required by the Protection of Personal Information Act (POPIA).

What You Should Do

We urge you to be extra cautious with messages you receive. Please follow these important steps:

• Be vigilant: Carefully scrutinise any unexpected text messages or phone calls.
• Never share personal information: We will never ask you for your password, banking details, or other sensitive personal information via our communication channels.
• Verify communications: If you receive a message that seems suspicious, please contact us directly through our official channels to verify its legitimacy.
• Consider Protective Registration: For an added layer of security against identity theft, you can place a free protective registration on your name with the South African Fraud Prevention Service (SAFPS). This alerts credit providers and banks that your identity has been compromised, making it harder for fraudsters to open accounts in your name. You can register on their website at www.safps.org.za.

We deeply regret any concern or inconvenience this incident may cause. Protecting your information is a top priority, and we are committed to being transparent as we manage this situation.

If you have any questions, please do not hesitate to contact our privacy team at io@pepkor.co.za.

Sincerely

The Pepkor Lifestyle Team